Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to… (CVE-2026-85971)

CVE-2026-85971 describes a vulnerability in Progress MarkLogic Server where versions 12.x before 12.1.0 and 11.x before 11.3.7 assign overly permissive OS permissions to certain log files. This vulnerability could enable a local user with limited privileges to read or alter log data, potentially compromising confidentiality and integrity of log information. The fix corrects default permissions for newly created and rotated logs, but existing logs require manual remediation to update permissions.

A local attacker with limited privileges could exploit this vulnerability to access or modify log files, potentially leading to information disclosure or tampering with audit trails. The vulnerability does not allow remote exploitation and does not impact availability.

Upgrade to Progress MarkLogic Server 12.1.0 or later, or 11.3.7 or later, where default permissions for new and rotated logs are corrected. For existing log files, manually adjust permissions to restrict access appropriately. No additional vendor advisory was provided; check official vendor resources for detailed remediation steps.